5023ffe58f1945012086d05f637983928e3e7c16eb5487196096d43b39d151ef

Analysis

max time kernel
125s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
Size

30KB
MD5

c2f261985677515ab220983bccfc1bee
SHA1

21e324d2c8bd664a080c8fecbcd118ee040bb628
SHA256

6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc
SHA512

62066d26fdf71cd69903855ee569ae75ae520976ade784eaeb100d98c74a6b965abe371b9f14fc41a09e1a28b803dca13533b989d643ef21939ba6366cb029b8
SSDEEP

768:jpiSqw4KqMqwZU/Tf+5g51qWMg6FU2btWLVkn:jeZqoTfwg5HMxpRWLVkn

Score

10^/10

ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\0_HELP_DECRYPT_FILES.html

Ransom Note

<html> <title> Decrypt Files </title> <center> <body> <div> <h1>Attention!</h1> <h2>All of your files have been encrypted!</h2> <p>----Not your language? USE: <a href=http://translate.google.com>Click Here</a>---- <br /> ------------------------------------------------------------------------------------------------- <br /> <h3>All of your files (photos, videos, documents, etc) are encrypted using AES-256 bit encryption</h3> <br />https://en.wikipedia.org/wiki/Advanced_Encryption_Standard <br /> <br /> Decrypting of your files is only possible with the private key and a decrypt program <br /> which is on our secret server. <br /> Decryption of your files will cost you $300 Dollars worth of Bitcoin <br /> <h4><font color=FF0000>Your files will be lost at 1/8/2024 3:31:48 PM, when this date has been passed your files are lost forever.</font></h4> <br /> <h3>Please follow these instructions:</h3> <br /> <h3>1. You can make a payment with Bitcoin, there are many methods to get them.</h3> <br /> <h3>2. Register a bitcoin wallet or login to one if you already have one, if you don't we recommend http://blockchain.info</h3> <br /> <h3>3. Purchasing Bitcoins, altought it's not yet easy to buy bitcoins, it's getting simpler every day</h3> <br /> Here are our recommendations: <br /> <a href=https://localbitcoins.com/>localbitcoins.com/</a> International <br /> <a href=http://blockchain.info>blockchain.info</a> <br /> <a href=http://coincafe.com>coincafe.com</a> <br /><a href=https://buy.bitcoin.com/>buy.bitcoin.com/</a> <h4>Need Help Buying Bitcoins?</h4> How to buy bitcoin: <a href=https://bitcoin.org/en/buy>Click Here</a> <h3>4. Send 0.1 Bitcoins to the address specified below. On the note when sending payment,include your personal Identifier and your email where <br /> you would like to receive your decryption program and key, if that is not possible send email to [email protected] with your Personal Identifier, your bitcoin transaction ID and your email address.</h3> <br /> -------------------------------------------------------------------------------------- <br /> YOUR PERSONAL IDENTIFIER: 8E368ACAD5FCB618301D37645FB10DA7 <br /> Bitcoin Address: (Send Bitcoins here): 15mA1ea42KSRpjYDiEJYjrHCjjMp3Cq3SG <br /> Bitcoin Amount: $300 Dollars worth of Bitcoins <br /> -------------------------------------------------------------------------------------- <br /> <h3>5. After your payment has been confirmed, you will receive your decryption program and key in 1 hour<br /> to your email address you specified on step 4.<br /> </h3> . <br /> </div> </body> </center> </html> <style> html { background-color: white; font-family: Helvetica, sans-serif; } div { background-color: lightgrey; width: 80: %; border: 2px solid black; padding: 25px; margin: 25px; } </style>

Emails

[email protected]

Wallets

15mA1ea42KSRpjYDiEJYjrHCjjMp3Cq3SG

URLs

http://blockchain.info</h3>

Extracted

Path

C:\Users\Admin\Documents\0_HELP_DECRYPT_FILES.txt

Ransom Note

Attention! All of your files have been encrypted ----Not your language? USE: https://translate.google.com/---- ------------------------------------------------------------------------------------------------- All of your files (photos, videos, documents, etc) are encrypted using AES-256 bit encryption https://en.wikipedia.org/wiki/Advanced_Encryption_Standard Decrypting of your files is only possible with the private key and a decrypt program which is on our secret server. Decryption of your files will cost you $300 Dollars worth of Bitcoin Your files will be lost at 1/8/2024 3:31:48 PM, when this date has been passed your files are lost forever. Please follow these instructions: 1. You can make a payment with Bitcoin, there are many methods to get them. 2. Register a bitcoin wallet or login to one if you already have one, if you don't we recommend http://blockchain.info 3. Purchasing Bitcoins, altought it's not yet easy to buy bitcoins, it's getting simpler every day Here are our recommendations: https://localbitcoins.com/ International https://blockchain.info https://coincafe.com https://buy.bitcoin.com/ 4. Send 300$ dollars worth of Bitcoins to the address specified below. On the note when sending payment,include your personal Identifier and your email where you would like to receive your decryption program and keyif that is not possible send email to [email protected] with your Personal Identifier, your bitcoin transaction ID and your email address. -------------------------------------------------------------------------------------- YOUR PERSONAL Identifier: 8E368ACAD5FCB618301D37645FB10DA7 Bitcoin Address: 15mA1ea42KSRpjYDiEJYjrHCjjMp3Cq3SG Bitcoin Amount: 300$ dollars worth of Bitcoins -------------------------------------------------------------------------------------- 5. After your payment has been confirmed, you will receive your decryption program and key in 1 hour to your email address you specified on step 4. .

Emails

[email protected]

Wallets

15mA1ea42KSRpjYDiEJYjrHCjjMp3Cq3SG

URLs

http://blockchain.info

https://buy.bitcoin.com/

Signatures

Renames multiple (200) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
2316	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0_HELP_DECRYPT_FILES.txt	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0_HELP_DECRYPT_FILES2.html	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410285017"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E11DFB71-A8BA-11EE-8A38-D6882E0F4692} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e50fe9e9255bddefd1763632f5914654dae2a29322c7f7a7b4fb5d5a373b8bc2000000000e800000000200002000000059720382b7ea0aa526adad5fd9721e394994c9df399ca9c07b4822180eb1057b900000005d829fe2bcb73717ff750e3a4fb056301773def4fb79371d1800dcb92e431cda9a1927316cef10cbfab94339c812a20726c9ea9439f6e9c6780d40835dc112c7ece5d42c2c7bc5ec8b8aee1ee75c77e1881afbe630d411437a47979879a62b8a8c3a9aa36803260557077a503e930a3bc29bdbc6e61b150352d63fb338ad6721715a7252f03d85921069dd79d72dce7040000000edf941a0754911b0bff0c4ff8bb3b2e2cb6b910e7cb1355364897944b0ad89fe937cbd141559bdba6395f5c4b83a3aa4f898d94b50d9ce433d07fb67bfbc0dd2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404624b6c73cda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000926ed0faa0d6a5462d08aac5633c18d59ae1c967a6e1128f55eeaa3ad0b89e1000000000e80000000020000200000004a3fad07d5d2d7bbea67c95b841a33090360c50dc4b618bb35f524ebd6e3807d200000005567e884855fa0047b9212add08ae4a007b94ac2e941e166e729d4ae7b292cbf4000000075da6487815f4a0ea97c55173a429e1c53d1e8d7c44ca348558063a73148df6987ed0ca72344376d17b77aacdee3cff541fe56b20d735befbb4a0026cf193a01	iexplore.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1644	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1596	iexplore.exe
1596	iexplore.exe
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE
1800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2640	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	29
PID 1940 wrote to memory of 2640	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	29
PID 1940 wrote to memory of 2640	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	29
PID 1940 wrote to memory of 1644	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	32
PID 1940 wrote to memory of 1644	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	32
PID 1940 wrote to memory of 1644	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	32
PID 1940 wrote to memory of 1596	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	33
PID 1940 wrote to memory of 1596	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	33
PID 1940 wrote to memory of 1596	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	33
PID 1596 wrote to memory of 1800	1596	iexplore.exe	35
PID 1596 wrote to memory of 1800	1596	iexplore.exe	35
PID 1596 wrote to memory of 1800	1596	iexplore.exe	35
PID 1596 wrote to memory of 1800	1596	iexplore.exe	35
PID 1940 wrote to memory of 2316	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	38
PID 1940 wrote to memory of 2316	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	38
PID 1940 wrote to memory of 2316	1940	6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe	38
PID 2316 wrote to memory of 1372	2316	cmd.exe	40
PID 2316 wrote to memory of 1372	2316	cmd.exe	40
PID 2316 wrote to memory of 1372	2316	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
"C:\Users\Admin\AppData\Local\Temp\6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe"
1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" vssadmin.exe delete shadows /all / quiet
  2⤵
  PID:2640
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\0_HELP_DECRYPT_FILES2.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1644
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\0_HELP_DECRYPT_FILES.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1596 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del C:\Users\Admin\AppData\Local\Temp\6a637e90e0673ee6090cc4fb47d82ab87ae7d26ffcff7a7dcafd4da167aea8bc.exe
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Windows\system32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a02bc664157e4e9fbe4d685861423cbb

SHA1
0c4f43ae15368a231e86eb5aff8231fbcdfa86c1

SHA256
544c999c4353eb62ceb3b2a49feb4310aa3a7cbc1121759a01aee25f5955483e

SHA512
60bdd5bd554d61ec5dd186f77cae0372dca2c2bea45849138b6d058ea300186ac3d86122839cc4416087ac222c43f5700295d764fbe047552cc3329b45e66697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2e1ffca856f89c757af4a21e6bb9499

SHA1
adece43a5b5a7920b95d22660bcc689391b17b33

SHA256
7d2e88e3f1435eea2bdcd45c46535aa5376d8b37349dc3da9b6d0cfa89f3d8b8

SHA512
46197f154713736aeeac73bded2e7f0c7260d8b3ef84099fe27bb2a5f7642d94356f7401fa06c2d137946151500dccef97ddcb86c258037d6ea92801f75695ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ac03259a5acad60e22913fca530b614

SHA1
c2adfa812520c33c9aa93c115d21bfc572a2e603

SHA256
83473086aac93c3475343f5151927c68056266bab739cac3e47a7babb68579e7

SHA512
86af505322e06329a7daa265759cf2f0a0271f3841a29b483bd7acd866b3d87e498e4dc04f79051ade293f793b55c88cadaa8db12edd3724943be51ff60ece9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8cae5a611668e76a6f2a252ab56bfd5a

SHA1
6b179eebe294bca815530bdf4a950685600a7106

SHA256
c3c5027d5b3ae386acc299dae09fd9cce238008358e9725db5b33cc22441211e

SHA512
08dbf1aca9b5f188134dd1b2302accd218427aed265fe575643a814286306cf259fa44cc11b22d5775cbf7bf5f8a857c792a236a3160c6db9033ebcfc33f0632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cfbc006398abc49639102590f264f778

SHA1
d4be366dd49950bb44697716d474356d07a492e9

SHA256
254bd068ad36f95fed8f3b20a815eea9191590d385f581b0529864a9f3ed4f2a

SHA512
a07f2e00ca021fe6d7ca2cfd5e8ec866ab822fdbfe5c53585237039bce194e33e8e457ecdb6f3e31d59730a1bd4833399469026b3981cfa5a5b867f761b345e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c9c41a170d7d9841ea6ebffa9283a84

SHA1
de51433d5f5ece1bb5f1045ae9371f199273ecb6

SHA256
a5ba7ac4ed42085e75df840a92ec232dc6b3a56328205f46351a4b6a8ad03711

SHA512
233eb93174ea7e5d85630bb99c5a60e14458fd3f4dbbbb3fa83e8578ba3ea46d75b62b4008f03209aff15563a77f112bfc093ec29d27169194eb653bb21746f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB8A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEBEB.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kzcnpuah.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Filesize
48KB

MD5
9681da36b36f1735ca035e11bf78d8ed

SHA1
f6317472df80d1b75b8d02dba1e5b44b139ad7d3

SHA256
9a5cd2e27c2949209f7767aa2e2f684ae7401af187d7231db41df320f84625d2

SHA512
35bbb23eb64cea5045b5847cc7a3decb684e957bc82dc44084c39e2991fd97b0a281f754b01720676298a877d224640af1f99631bae925395c96bff8aa05107b

Download Submit
C:\Users\Admin\Documents\0_HELP_DECRYPT_FILES.txt

Filesize
1KB

MD5
20f315c7493ef0efe00165c963307c5f

SHA1
1d0c252b44a3a600b208c42c27e7dd8458f251a2

SHA256
a0e0e6e5d74b579c72952685924615c6361981a419bd2f3c602381c8d460b1d5

SHA512
d44b91babbeff3d2595ea8d7dd2064058a1e1a3f862d28e43225d674d2ec2090fbcab1d7fbd6dba7471ab33a19f304edd639016abba6cba7ba5754a7d0c8c267

Download Submit
C:\Users\Admin\Pictures\0_HELP_DECRYPT_FILES.html

Filesize
2KB

MD5
09c9ed6b8ba1662393a92d572e97f157

SHA1
739227048cfcc31b1f5c9eaa4e01c951c5568af2

SHA256
ddce7bbc35302efeeb31b779dda6a62720e2b53748f0ded2e5e629f2a359919c

SHA512
39cb5a4269b3fee435cb9a2a3a5e7c6986d5d6cb85bee1f1e277ca0e56892130dd6e72a9a3b57cb116ba0e8526fa9734933ac8674a43574318ffb1ba76a18b0e

Download Submit
memory/1940-0-0x0000000000C90000-0x0000000000C9E000-memory.dmp

Filesize
56KB

Download
memory/1940-459-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download
memory/1940-3-0x000000001B0C0000-0x000000001B140000-memory.dmp

Filesize
512KB

Download
memory/1940-2-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1940-1-0x000007FEF5E30000-0x000007FEF681C000-memory.dmp

Filesize
9.9MB

Download